proftpd/patches/proftpd-1.3.0a-ctrls-bug2867.patch

--- src/ctrls.c	2006/10/24 16:13:31	1.14
+++ src/ctrls.c	2006/12/12 16:34:43	1.15
@@ -534,11 +534,20 @@
     return -1;
   }
 
+  if (reqarglen >= sizeof(reqaction)) {
+    pr_signals_unblock();
+    errno = ENOMEM;
+    return -1;
+  }
+
+  memset(reqaction, '\0', sizeof(reqaction));
+
   if (read(cl->cl_fd, reqaction, reqarglen) < 0) {
     pr_signals_unblock();
     return -1;
   }
 
+  reqaction[sizeof(reqaction)-1] = '\0';
   nreqargs--;
 
   /* Find a matching action object, and use it to populate a ctrl object,
@@ -657,17 +666,16 @@
       return -1;
     }
 
-    memset(response, '\0', sizeof(response));
-
     /* Make sure resparglen is not too big */
-    if (resparglen > sizeof(response)) {
+    if (resparglen >= sizeof(response)) {
       pr_signals_unblock();
       errno = ENOMEM;
       return -1;
     }
 
-    bread = read(ctrls_sockfd, response, resparglen);
+    memset(response, '\0', sizeof(response));
 
+    bread = read(ctrls_sockfd, response, resparglen);
     while (bread != resparglen) {
       if (bread < 0) {
         pr_signals_unblock(); 
1	niro	265	--- src/ctrls.c 2006/10/24 16:13:31 1.14
2			+++ src/ctrls.c 2006/12/12 16:34:43 1.15
3			@@ -534,11 +534,20 @@
4			return -1;
5			}
6
7			+ if (reqarglen >= sizeof(reqaction)) {
8			+ pr_signals_unblock();
9			+ errno = ENOMEM;
10			+ return -1;
11			+ }
12			+
13			+ memset(reqaction, '\0', sizeof(reqaction));
14			+
15			if (read(cl->cl_fd, reqaction, reqarglen) < 0) {
16			pr_signals_unblock();
17			return -1;
18			}
19
20			+ reqaction[sizeof(reqaction)-1] = '\0';
21			nreqargs--;
22
23			/* Find a matching action object, and use it to populate a ctrl object,
24			@@ -657,17 +666,16 @@
25			return -1;
26			}
27
28			- memset(response, '\0', sizeof(response));
29			-
30			/* Make sure resparglen is not too big */
31			- if (resparglen > sizeof(response)) {
32			+ if (resparglen >= sizeof(response)) {
33			pr_signals_unblock();
34			errno = ENOMEM;
35			return -1;
36			}
37
38			- bread = read(ctrls_sockfd, response, resparglen);
39			+ memset(response, '\0', sizeof(response));
40
41			+ bread = read(ctrls_sockfd, response, resparglen);
42			while (bread != resparglen) {
43			if (bread < 0) {
44			pr_signals_unblock();